NGINX - Core Dump

Back


Id	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
Rulename	NGINX - Core Dump
Description	Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
Version	1.0.3
Arm template	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec.json

KQL

NGINXHTTPServer
| where EventType =~ "ErrorLog"
| where EventMessage contains 'exited on signal 6 (core dumped)'
| extend ProcessIdCustomEntity = ProcessId

YAML

tactics:
- Impact
relevantTechniques:
- T1499
version: 1.0.3
triggerOperator: gt
name: NGINX - Core Dump
id: 9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
description: |
    'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'
queryFrequency: 10m
severity: High
status: Available
query: |
  NGINXHTTPServer
  | where EventType =~ "ErrorLog"
  | where EventMessage contains 'exited on signal 6 (core dumped)'
  | extend ProcessIdCustomEntity = ProcessId  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
queryPeriod: 10m
triggerThreshold: 0
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: ProcessId
    columnName: ProcessIdCustomEntity
  entityType: Process
requiredDataConnectors:
- dataTypes:
  - NGINX_CL
  connectorId: CustomLogsAma

ARM